What is adding entry lines to my package.json, and why?

Question

I have a npm package that I maintain. Something - perhaps npm itself - is adding entries to package.json. They start with an underscore character:

"_args": [
  [
    {
      "raw": "some-cool-package@https://registry.npmjs.org/some-cool-package/-/some-cool-package-2.2.0.tgz",
      "scope": null,
      "escapedName": "some-cool-package",
      "name": "some-cool-package",
      "rawSpec": "https://registry.npmjs.org/some-cool-package/-/some-cool-package-2.2.0.tgz",
      "spec": "https://registry.npmjs.org/some-cool-package/-/some-cool-package-2.2.0.tgz",
      "type": "remote"
    },
    "C:\\Users\\mike\\Documents\\mycompany"
  ]
],
"_from": "some-cool-package@>=2.2.0 <3.0.0",
"_id": "[email protected]",
"_inCache": true,
"_location": "/some-cool-package",
"_phantomChildren": {},
"_requested": {
  "raw": "some-cool-package@https://registry.npmjs.org/some-cool-package/-/some-cool-package-2.2.0.tgz",
  "scope": null,
  "escapedName": "some-cool-package",
  "name": "some-cool-package",
  "rawSpec": "https://registry.npmjs.org/some-cool-package/-/some-cool-package-2.2.0.tgz",
  "spec": "https://registry.npmjs.org/some-cool-package/-/some-cool-package-2.2.0.tgz",
  "type": "remote"
},
"_requiredBy": [
  "/"
],
"_resolved": "https://registry.npmjs.org/some-cool-package/-/some-cool-package-2.2.0.tgz",
"_shasum": "f0d5d982c15d63f653e48fff552400eb241b7407",
"_shrinkwrap": null,
"_spec": "some-cool-package@https://registry.npmjs.org/some-cool-package/-/some-cool-package-2.2.0.tgz",
"_where": "C:\\Users\\mike\\Documents\\mycompany",

What is adding these entries?

Should I leave these entries on packages I publish to the public npm registry, or delete them?

Answer 1

I think you're right, and that it's NPM itself putting absolute URLs into the package.json file.

It seems you're not the only one experiencing this issue, and that there seems to be no plan to fix it either (issue was closed on 15 Dec 2015), unfortunately.

Although one commenter recommended the removeNPMAbsolutePaths package to resolve this issue.

Answer 2

This issue is fixed in npm@5, if you update the publisher npm to npm@5 and re-publish packages, you'll notice that some of these additional entries are gone.